@deftai/directive-core 0.55.0

package/dist/intake/candidates-log.js

@@ -0,0 +1,224 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, unlinkSync, writeSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { pyRepr } from "../scm/py-format.js";
+export const DEFAULT_LOG_PATH = resolve(import.meta.dirname, "..", "..", "..", "..", "vbrief", ".eval", "candidates.jsonl");
+const VALID_DECISIONS = new Set([
+    "accept",
+    "reject",
+    "defer",
+    "needs-ac",
+    "mark-duplicate",
+    "reset",
+    "resume-eligible",
+]);
+const PRIOR_REQUIRED_DECISIONS = new Set(["reset", "resume-eligible"]);
+const REQUIRED_FIELDS = [
+    "decision_id",
+    "timestamp",
+    "repo",
+    "issue_number",
+    "decision",
+    "actor",
+];
+const OPTIONAL_FIELDS = ["reason", "resume_on", "linked_to", "prior_decision_id"];
+const ALLOWED_FIELDS = new Set([...REQUIRED_FIELDS, ...OPTIONAL_FIELDS]);
+const UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+const REPO_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const ISO8601_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
+let threadLocked = false;
+export class CandidatesLogError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CandidatesLogError";
+    }
+}
+function validateEntry(entry) {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+        throw new CandidatesLogError(`entry must be a dict, got ${typeof entry}`);
+    }
+    const obj = entry;
+    const missing = REQUIRED_FIELDS.filter((f) => !(f in obj));
+    if (missing.length > 0) {
+        throw new CandidatesLogError(`entry missing required field(s): ${pyRepr(missing)}`);
+    }
+    const extras = [...Object.keys(obj)].filter((k) => !ALLOWED_FIELDS.has(k)).sort();
+    if (extras.length > 0) {
+        throw new CandidatesLogError(`entry has unknown field(s): ${pyRepr(extras)}`);
+    }
+    const decisionId = obj.decision_id;
+    if (typeof decisionId !== "string" || !UUID_PATTERN.test(decisionId)) {
+        throw new CandidatesLogError(`decision_id must be a UUID string, got ${JSON.stringify(decisionId)}`);
+    }
+    const timestamp = obj.timestamp;
+    if (typeof timestamp !== "string" || !ISO8601_PATTERN.test(timestamp)) {
+        throw new CandidatesLogError(`timestamp must be ISO-8601 UTC with Z suffix (e.g. 2026-05-03T16:32:54Z), got ${JSON.stringify(timestamp)}`);
+    }
+    const repo = obj.repo;
+    if (typeof repo !== "string" || !REPO_PATTERN.test(repo)) {
+        throw new CandidatesLogError(`repo must match 'owner/name', got ${JSON.stringify(repo)}`);
+    }
+    const issueNumber = obj.issue_number;
+    if (typeof issueNumber !== "number" || !Number.isInteger(issueNumber) || issueNumber < 1) {
+        throw new CandidatesLogError(`issue_number must be a positive int, got ${JSON.stringify(issueNumber)}`);
+    }
+    const decision = obj.decision;
+    if (typeof decision !== "string" || !VALID_DECISIONS.has(decision)) {
+        throw new CandidatesLogError(`decision must be one of ${JSON.stringify([...VALID_DECISIONS].sort())}, got ${JSON.stringify(decision)}`);
+    }
+    const actor = obj.actor;
+    if (typeof actor !== "string" || actor.length === 0) {
+        throw new CandidatesLogError(`actor must be a non-empty string, got ${JSON.stringify(actor)}`);
+    }
+    if ("reason" in obj && typeof obj.reason !== "string") {
+        throw new CandidatesLogError(`reason must be a string, got ${typeof obj.reason}`);
+    }
+    if ("resume_on" in obj) {
+        const resumeOn = obj.resume_on;
+        if (typeof resumeOn !== "string" || resumeOn.length === 0) {
+            throw new CandidatesLogError(`resume_on must be a non-empty string, got ${JSON.stringify(resumeOn)}`);
+        }
+    }
+    if (decision === "mark-duplicate") {
+        if (!("linked_to" in obj)) {
+            throw new CandidatesLogError("decision 'mark-duplicate' requires 'linked_to'");
+        }
+        const linkedTo = obj.linked_to;
+        if (typeof linkedTo !== "number" || !Number.isInteger(linkedTo) || linkedTo < 1) {
+            throw new CandidatesLogError(`linked_to must be a positive int, got ${JSON.stringify(linkedTo)}`);
+        }
+    }
+    else if ("linked_to" in obj) {
+        throw new CandidatesLogError("'linked_to' is only valid for decision='mark-duplicate'");
+    }
+    if (PRIOR_REQUIRED_DECISIONS.has(decision)) {
+        if (!("prior_decision_id" in obj)) {
+            throw new CandidatesLogError(`decision ${JSON.stringify(decision)} requires 'prior_decision_id'`);
+        }
+        const pid = obj.prior_decision_id;
+        if (typeof pid !== "string" || !UUID_PATTERN.test(pid)) {
+            throw new CandidatesLogError(`prior_decision_id must be a UUID string, got ${JSON.stringify(pid)}`);
+        }
+    }
+    else if ("prior_decision_id" in obj) {
+        throw new CandidatesLogError(`'prior_decision_id' is only valid for decision in ${JSON.stringify([...PRIOR_REQUIRED_DECISIONS].sort())}`);
+    }
+}
+function resolvePath(path) {
+    return path !== undefined && path !== null ? resolve(path) : DEFAULT_LOG_PATH;
+}
+function acquireAppendLock(logPath) {
+    while (threadLocked) {
+        // spin-wait for in-process serialization
+    }
+    threadLocked = true;
+    const lockPath = join(dirname(logPath), `${logPath.split(/[/\\]/).pop()}.lock`);
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const deadline = Date.now() + 30_000;
+    let fd = null;
+    while (fd === null) {
+        try {
+            fd = openSync(lockPath, "wx");
+        }
+        catch {
+            if (Date.now() > deadline) {
+                threadLocked = false;
+                throw new CandidatesLogError("timed out acquiring candidates log lock");
+            }
+            const spinEnd = Date.now() + 20;
+            while (Date.now() < spinEnd) {
+                // brief spin
+            }
+        }
+    }
+    writeSync(fd, Buffer.from("\0"));
+    return () => {
+        try {
+            if (fd !== null) {
+                closeSync(fd);
+            }
+        }
+        catch {
+            // ignore
+        }
+        try {
+            unlinkSync(lockPath);
+        }
+        catch {
+            // ignore
+        }
+        threadLocked = false;
+    };
+}
+export function validateCandidatesEntry(entry) {
+    validateEntry(entry);
+}
+export function append(entry, options = {}) {
+    validateEntry(entry);
+    const logPath = resolvePath(options.path);
+    mkdirSync(dirname(logPath), { recursive: true });
+    const line = JSON.stringify(entry, Object.keys(entry).sort());
+    const release = acquireAppendLock(logPath);
+    try {
+        const fd = openSync(logPath, "a");
+        try {
+            writeSync(fd, Buffer.from(`${line}\n`, "utf8"));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    finally {
+        release();
+    }
+    return String(entry.decision_id);
+}
+export function readAll(repo = null, options = {}) {
+    const logPath = resolvePath(options.path);
+    if (!existsSync(logPath)) {
+        return [];
+    }
+    const warn = options.warn ?? (() => { });
+    const out = [];
+    const lines = readFileSync(logPath, "utf8").split("\n");
+    for (let lineno = 0; lineno < lines.length; lineno += 1) {
+        const stripped = lines[lineno]?.trim() ?? "";
+        if (stripped.length === 0) {
+            continue;
+        }
+        let obj;
+        try {
+            obj = JSON.parse(stripped);
+        }
+        catch (exc) {
+            warn(`candidates.jsonl: skipping malformed JSON on line ${lineno + 1}: ${String(exc)}`);
+            continue;
+        }
+        if (obj === null || typeof obj !== "object" || Array.isArray(obj)) {
+            warn(`candidates.jsonl: skipping non-object entry on line ${lineno + 1} (got ${typeof obj})`);
+            continue;
+        }
+        const record = obj;
+        if (repo !== null && record.repo !== repo) {
+            continue;
+        }
+        out.push(record);
+    }
+    return out;
+}
+export function findByIssue(issueNumber, repo, options = {}) {
+    return readAll(repo, options).filter((e) => e.issue_number === issueNumber);
+}
+export function latestDecision(issueNumber, repo, options = {}) {
+    const rows = findByIssue(issueNumber, repo, options);
+    if (rows.length === 0) {
+        return null;
+    }
+    rows.sort((a, b) => String(a.timestamp ?? "").localeCompare(String(b.timestamp ?? "")));
+    return rows[rows.length - 1] ?? null;
+}
+export function newDecisionId() {
+    return randomUUID();
+}
+//# sourceMappingURL=candidates-log.js.map

package/dist/intake/github-auth-modes-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function mainEntry(argv?: string[]): number;
+//# sourceMappingURL=github-auth-modes-cli.d.ts.map

package/dist/intake/github-auth-modes-cli.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { githubAuthModesMain } from "./github-auth-modes.js";
+function parseArgs(argv) {
+    const out = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--json")
+            out.json = true;
+        else if (arg === "--repo")
+            out.repo = argv[++i];
+        else if (arg === "--github-auth-mode")
+            out.githubAuthMode = argv[++i];
+    }
+    return out;
+}
+export function mainEntry(argv = process.argv.slice(2)) {
+    return githubAuthModesMain(parseArgs(argv));
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(mainEntry());
+}
+//# sourceMappingURL=github-auth-modes-cli.js.map

package/dist/intake/github-auth-modes.d.ts

@@ -0,0 +1,54 @@
+import { type CompletedProcess } from "../scm/call.js";
+import { probeRuntimeCapabilities, type RuntimeCapabilityReport } from "./platform-capabilities.js";
+export declare const GITHUB_AUTH_MODE_INJECTED_TOKEN = "injected-token";
+export declare const GITHUB_AUTH_MODE_HOST_GH = "host-gh";
+export declare const KNOWN_GITHUB_AUTH_MODES: Set<string>;
+export declare const DEFAULT_VALIDATION_REPO = "deftai/directive";
+export declare const FAILURE_MISSING_INJECTED_TOKEN = "missing_injected_token";
+export declare const FAILURE_GH_AUTH = "gh_auth_failed";
+export declare const FAILURE_API_UNREACHABLE = "api_unreachable";
+export declare const FAILURE_REPO_ACCESS = "repo_access_denied";
+export declare const FAILURE_INVALID_MODE = "invalid_auth_mode";
+export interface GitHubAuthValidationResult {
+    readonly ok: boolean;
+    readonly githubAuthMode: string;
+    readonly runtimeMode: string | null;
+    readonly failureKind: string | null;
+    readonly detail: string;
+    readonly remediation: string | null;
+    readonly login: string | null;
+}
+export type GhRunner = (args: readonly string[], environ: NodeJS.ProcessEnv) => CompletedProcess;
+export declare function findInjectedToken(environ: NodeJS.ProcessEnv): string | null;
+export declare function inferGithubAuthMode(runtimeReport: RuntimeCapabilityReport): string;
+export declare function validateInjectedTokenMode(environ: NodeJS.ProcessEnv, options?: {
+    repo?: string;
+    runtimeMode?: string | null;
+    runGh?: GhRunner;
+}): GitHubAuthValidationResult;
+export declare function validateHostGhMode(environ: NodeJS.ProcessEnv, options?: {
+    repo?: string;
+    runtimeMode?: string | null;
+    runGh?: GhRunner;
+}): GitHubAuthValidationResult;
+export declare function validateGithubAuth(githubAuthMode: string, options?: {
+    environ?: NodeJS.ProcessEnv;
+    runtimeReport?: RuntimeCapabilityReport | null;
+    repo?: string;
+    runGh?: GhRunner;
+}): GitHubAuthValidationResult;
+export declare function validateGithubAuthForWorker(githubAuthMode?: string | null, options?: {
+    environ?: NodeJS.ProcessEnv;
+    runtimeReport?: RuntimeCapabilityReport | null;
+    repo?: string;
+    runGh?: GhRunner;
+}): GitHubAuthValidationResult;
+export declare function resultToDict(result: GitHubAuthValidationResult): Record<string, unknown>;
+export interface GitHubAuthModesCliArgs {
+    githubAuthMode?: string | null;
+    repo?: string;
+    json?: boolean;
+}
+export declare function githubAuthModesMain(args: GitHubAuthModesCliArgs): number;
+export { probeRuntimeCapabilities };
+//# sourceMappingURL=github-auth-modes.d.ts.map

package/dist/intake/github-auth-modes.js

@@ -0,0 +1,275 @@
+import { call } from "../scm/call.js";
+import { pyRepr } from "../scm/py-format.js";
+import { getPlatformCapabilities, probeRuntimeCapabilities, RUNTIME_MODE_CLOUD_HEADLESS, RUNTIME_MODE_CURSOR_NATIVE_SANDBOX, } from "./platform-capabilities.js";
+export const GITHUB_AUTH_MODE_INJECTED_TOKEN = "injected-token";
+export const GITHUB_AUTH_MODE_HOST_GH = "host-gh";
+export const KNOWN_GITHUB_AUTH_MODES = new Set([
+    GITHUB_AUTH_MODE_INJECTED_TOKEN,
+    GITHUB_AUTH_MODE_HOST_GH,
+]);
+export const DEFAULT_VALIDATION_REPO = "deftai/directive";
+export const FAILURE_MISSING_INJECTED_TOKEN = "missing_injected_token";
+export const FAILURE_GH_AUTH = "gh_auth_failed";
+export const FAILURE_API_UNREACHABLE = "api_unreachable";
+export const FAILURE_REPO_ACCESS = "repo_access_denied";
+export const FAILURE_INVALID_MODE = "invalid_auth_mode";
+const INJECTED_TOKEN_ENV_VARS = ["GH_TOKEN", "GITHUB_TOKEN", "GH_ENTERPRISE_TOKEN"];
+const SANDBOX_REMEDIATION = "Remediation options for worker sandbox GitHub auth failures:\n" +
+    "  - Run the GitHub step with full-access execution\n" +
+    "  - Allowlist the trusted gh command path for the worker sandbox\n" +
+    "  - Use injected-token handoff (keep token values out of prompts and transcripts)";
+const REPO_ACCESS_REMEDIATION = "Remediation options for repo-access failures:\n" +
+    "  - Confirm the worker credential can read the target repository\n" +
+    "  - Run the GitHub step with full-access execution if host gh has access\n" +
+    "  - Use injected-token handoff scoped to the required repository";
+export function findInjectedToken(environ) {
+    for (const name of INJECTED_TOKEN_ENV_VARS) {
+        const value = environ[name]?.trim() ?? "";
+        if (value.length > 0) {
+            return value;
+        }
+    }
+    return null;
+}
+export function inferGithubAuthMode(runtimeReport) {
+    if (runtimeReport.runtimeMode === RUNTIME_MODE_CLOUD_HEADLESS) {
+        return GITHUB_AUTH_MODE_INJECTED_TOKEN;
+    }
+    return GITHUB_AUTH_MODE_HOST_GH;
+}
+function defaultRunGh(args, environ) {
+    const verb = args[0];
+    return call("github-issue", verb, args.slice(1), { env: environ, timeout: 30 });
+}
+function splitRepo(repo) {
+    const idx = repo.indexOf("/");
+    if (idx <= 0 || idx >= repo.length - 1) {
+        throw new Error(`invalid repository slug: ${JSON.stringify(repo)} (expected owner/repo)`);
+    }
+    return [repo.slice(0, idx), repo.slice(idx + 1)];
+}
+function sandboxRemediation(runtimeMode, failureKind) {
+    if (runtimeMode !== RUNTIME_MODE_CURSOR_NATIVE_SANDBOX) {
+        return null;
+    }
+    if (failureKind === FAILURE_GH_AUTH ||
+        failureKind === FAILURE_API_UNREACHABLE ||
+        failureKind === FAILURE_REPO_ACCESS) {
+        return SANDBOX_REMEDIATION;
+    }
+    return null;
+}
+function repoAccessRemediation(failureKind) {
+    return failureKind === FAILURE_REPO_ACCESS ? REPO_ACCESS_REMEDIATION : null;
+}
+function mergeRemediation(runtimeMode, failureKind) {
+    const parts = [];
+    const sandbox = sandboxRemediation(runtimeMode, failureKind);
+    if (sandbox !== null) {
+        parts.push(sandbox);
+    }
+    const repo = repoAccessRemediation(failureKind);
+    if (repo !== null && !parts.includes(repo)) {
+        parts.push(repo);
+    }
+    return parts.length > 0 ? parts.join("\n\n") : null;
+}
+function parseLogin(stdout) {
+    const text = stdout.trim();
+    if (text.length === 0) {
+        return null;
+    }
+    try {
+        const payload = JSON.parse(text);
+        if (typeof payload === "string" && payload.length > 0) {
+            return payload;
+        }
+        if (payload !== null && typeof payload === "object" && !Array.isArray(payload)) {
+            const login = payload.login;
+            if (typeof login === "string" && login.length > 0) {
+                return login;
+            }
+        }
+    }
+    catch {
+        return text;
+    }
+    return null;
+}
+export function validateInjectedTokenMode(environ, options = {}) {
+    const runner = options.runGh ?? defaultRunGh;
+    const repo = options.repo ?? DEFAULT_VALIDATION_REPO;
+    const runtimeMode = options.runtimeMode ?? null;
+    const token = findInjectedToken(environ);
+    if (token === null) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: FAILURE_MISSING_INJECTED_TOKEN,
+            detail: "injected-token mode requires GH_TOKEN, GITHUB_TOKEN, or GH_ENTERPRISE_TOKEN; host gh credential store is not used",
+            remediation: null,
+            login: null,
+        };
+    }
+    const authStatus = runner(["auth", "status"], environ);
+    if (authStatus.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: FAILURE_GH_AUTH,
+            detail: "injected token present but gh auth status failed in worker",
+            remediation: mergeRemediation(runtimeMode, FAILURE_GH_AUTH),
+            login: null,
+        };
+    }
+    const userApi = runner(["api", "user", "--jq", ".login"], environ);
+    if (userApi.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: FAILURE_API_UNREACHABLE,
+            detail: "injected token present but GitHub API is unreachable",
+            remediation: mergeRemediation(runtimeMode, FAILURE_API_UNREACHABLE),
+            login: null,
+        };
+    }
+    const login = parseLogin(userApi.stdout);
+    const [owner, name] = splitRepo(repo);
+    const repoApi = runner(["api", `repos/${owner}/${name}`], environ);
+    if (repoApi.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+            runtimeMode,
+            failureKind: FAILURE_REPO_ACCESS,
+            detail: `injected token can reach GitHub API but cannot access ${repo}`,
+            remediation: mergeRemediation(runtimeMode, FAILURE_REPO_ACCESS),
+            login,
+        };
+    }
+    return {
+        ok: true,
+        githubAuthMode: GITHUB_AUTH_MODE_INJECTED_TOKEN,
+        runtimeMode,
+        failureKind: null,
+        detail: "injected-token mode validated in worker environment",
+        remediation: null,
+        login,
+    };
+}
+export function validateHostGhMode(environ, options = {}) {
+    const runner = options.runGh ?? defaultRunGh;
+    const repo = options.repo ?? DEFAULT_VALIDATION_REPO;
+    const runtimeMode = options.runtimeMode ?? null;
+    const authStatus = runner(["auth", "status"], environ);
+    if (authStatus.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+            runtimeMode,
+            failureKind: FAILURE_GH_AUTH,
+            detail: "gh auth status failed in worker environment",
+            remediation: mergeRemediation(runtimeMode, FAILURE_GH_AUTH),
+            login: null,
+        };
+    }
+    const userApi = runner(["api", "user", "--jq", ".login"], environ);
+    if (userApi.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+            runtimeMode,
+            failureKind: FAILURE_API_UNREACHABLE,
+            detail: "gh auth status passed but GitHub API is unreachable",
+            remediation: mergeRemediation(runtimeMode, FAILURE_API_UNREACHABLE),
+            login: null,
+        };
+    }
+    const [owner, name] = splitRepo(repo);
+    const repoApi = runner(["api", `repos/${owner}/${name}`], environ);
+    if (repoApi.returncode !== 0) {
+        return {
+            ok: false,
+            githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+            runtimeMode,
+            failureKind: FAILURE_REPO_ACCESS,
+            detail: `GitHub API reachable but repository access failed for ${repo}`,
+            remediation: mergeRemediation(runtimeMode, FAILURE_REPO_ACCESS),
+            login: parseLogin(userApi.stdout),
+        };
+    }
+    return {
+        ok: true,
+        githubAuthMode: GITHUB_AUTH_MODE_HOST_GH,
+        runtimeMode,
+        failureKind: null,
+        detail: "host-gh mode validated in worker environment",
+        remediation: null,
+        login: parseLogin(userApi.stdout),
+    };
+}
+export function validateGithubAuth(githubAuthMode, options = {}) {
+    const env = options.environ ?? process.env;
+    const runtimeMode = options.runtimeReport?.runtimeMode ?? null;
+    if (!KNOWN_GITHUB_AUTH_MODES.has(githubAuthMode)) {
+        return {
+            ok: false,
+            githubAuthMode,
+            runtimeMode,
+            failureKind: FAILURE_INVALID_MODE,
+            detail: `unknown github_auth_mode ${pyRepr(githubAuthMode)}; expected one of ${pyRepr([...KNOWN_GITHUB_AUTH_MODES].sort())}`,
+            remediation: null,
+            login: null,
+        };
+    }
+    if (githubAuthMode === GITHUB_AUTH_MODE_INJECTED_TOKEN) {
+        return validateInjectedTokenMode(env, {
+            repo: options.repo,
+            runtimeMode,
+            runGh: options.runGh,
+        });
+    }
+    return validateHostGhMode(env, {
+        repo: options.repo,
+        runtimeMode,
+        runGh: options.runGh,
+    });
+}
+export function validateGithubAuthForWorker(githubAuthMode = null, options = {}) {
+    const report = options.runtimeReport ?? getPlatformCapabilities();
+    const mode = githubAuthMode ?? inferGithubAuthMode(report);
+    return validateGithubAuth(mode, { ...options, runtimeReport: report });
+}
+export function resultToDict(result) {
+    return {
+        ok: result.ok,
+        github_auth_mode: result.githubAuthMode,
+        runtime_mode: result.runtimeMode,
+        failure_kind: result.failureKind,
+        detail: result.detail,
+        remediation: result.remediation,
+        login: result.login,
+    };
+}
+export function githubAuthModesMain(args) {
+    const result = validateGithubAuthForWorker(args.githubAuthMode ?? null, {
+        repo: args.repo ?? DEFAULT_VALIDATION_REPO,
+    });
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(resultToDict(result), null, 2)}\n`);
+    }
+    else {
+        const status = result.ok ? "ok" : "failed";
+        process.stdout.write(`github_auth_mode=${result.githubAuthMode} status=${status}\n`);
+        process.stdout.write(`detail=${result.detail}\n`);
+        if (result.remediation !== null) {
+            process.stdout.write(`${result.remediation}\n`);
+        }
+    }
+    return result.ok ? 0 : 1;
+}
+export { probeRuntimeCapabilities };
+//# sourceMappingURL=github-auth-modes.js.map

package/dist/intake/github-body-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare function mainEntry(argv?: string[]): number;
+//# sourceMappingURL=github-body-cli.d.ts.map

package/dist/intake/github-body-cli.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { githubBodyMain } from "./github-body.js";
+function parseArgs(argv) {
+    const out = { command: argv[0] ?? "" };
+    for (let i = 1; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--repo")
+            out.repo = argv[++i];
+        else if (arg === "--title")
+            out.title = argv[++i];
+        else if (arg === "--issue")
+            out.issue = Number.parseInt(argv[++i], 10);
+        else if (arg === "--comment")
+            out.comment = Number.parseInt(argv[++i], 10);
+        else if (arg === "--pr")
+            out.pr = Number.parseInt(argv[++i], 10);
+        else if (arg === "--body-file")
+            out.bodyFile = argv[++i];
+    }
+    return out;
+}
+export function mainEntry(argv = process.argv.slice(2)) {
+    const parsed = parseArgs(argv);
+    return githubBodyMain(parsed);
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(mainEntry());
+}
+//# sourceMappingURL=github-body-cli.js.map

package/dist/intake/github-body.d.ts

@@ -0,0 +1,48 @@
+export declare const DEFAULT_TIMEOUT_SECONDS = 60;
+export declare class GitHubBodyError extends Error {
+    constructor(message: string);
+}
+export type RunGhApiFn = (args: readonly string[], options?: {
+    inputText?: string | null;
+    binary?: string;
+}) => Record<string, unknown>;
+/** Resolve the live GitHub CLI used for writes and mutation read-back. */
+export declare function resolveLiveGh(): string;
+export declare function readBody(bodyFile: string, stdinText?: string | null): string;
+export declare function createIssue(repo: string, options: {
+    title: string;
+    body: string;
+    binary?: string | null;
+    runFn?: RunGhApiFn;
+}): Record<string, unknown>;
+export declare function editIssueBody(repo: string, issue: number, options: {
+    body: string;
+    binary?: string | null;
+    runFn?: RunGhApiFn;
+}): Record<string, unknown>;
+export declare function createIssueComment(repo: string, issue: number, options: {
+    body: string;
+    binary?: string | null;
+    runFn?: RunGhApiFn;
+}): Record<string, unknown>;
+export declare function editIssueCommentBody(repo: string, commentId: number, options: {
+    body: string;
+    binary?: string | null;
+    runFn?: RunGhApiFn;
+}): Record<string, unknown>;
+export declare function editPrBody(repo: string, pr: number, options: {
+    body: string;
+    binary?: string | null;
+    runFn?: RunGhApiFn;
+}): Record<string, unknown>;
+export interface GitHubBodyCliArgs {
+    command: string;
+    repo?: string;
+    title?: string;
+    issue?: number;
+    comment?: number;
+    pr?: number;
+    bodyFile?: string;
+}
+export declare function githubBodyMain(args: GitHubBodyCliArgs): number;
+//# sourceMappingURL=github-body.d.ts.map